CVE-2026-84741: Exposure of Sensitive Information to an Unauthorized Actor

The Events Calendar WordPress plugin before 6.17.5 does not check the post status of linked records before embedding their stored details into a public REST API response, allowing unauthenticated users to read the contents of records that have never been published...

CVE-2026-84027: Missing Authorization

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not check user capabilities when creating orders through its REST API, allowing users with the subscriber role and above to create paid order and payment records with arbitrary amounts and...

PT-2026-97182

Name of the Vulnerable Software and Affected Versions Social Commerce for WooCommerce WordPress plugin versions prior to 2.5.5 Description Lack of authorization checks on certain REST API endpoints allows unauthenticated users to modify the plugin configuration and the product synchronization...

PT-2026-97181

Name of the Vulnerable Software and Affected Versions Post Grid Gutenberg Blocks versions prior to 5.0.41 Description An issue exists where the plugin fails to perform authorization or post-visibility checks on a REST API route. This allows unauthenticated users to disclose the custom field key...

PT-2026-97169

Name of the Vulnerable Software and Affected Versions The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin versions prior to 8.9.5 Description The plugin fails to verify user capabilities when processing order creation via its REST API. This allows users with...

PT-2026-97174

Name of the Vulnerable Software and Affected Versions The Events Calendar WordPress plugin versions prior to 6.17.5 Description A broken access control issue exists where the software fails to verify the post status of linked records before including their stored details in a public REST API...

PT-2026-97175

Name of the Vulnerable Software and Affected Versions The Events Calendar WordPress plugin versions prior to 6.17.5 Description The plugin fails to verify the necessary permissions required to publish content when creating or updating entries via its REST API. This allows users with restricted...

UBUNTU-CVE-2026-62364

wlc is a Weblate command-line client using Weblate's REST API. Prior to 2.0.1, automatically discovered configuration from .weblate, .weblate.ini, or weblate.ini can select the API URL while an unscoped API token is supplied through WLCKEY or --key without a matching WLCURL or --url. When wlc run...

CVE-2026-62364

wlc is a Weblate command-line client using Weblate's REST API. Prior to 2.0.1, automatically discovered configuration from .weblate, .weblate.ini, or weblate.ini can select the API URL while an unscoped API token is supplied through WLCKEY or --key without a matching WLCURL or --url. When wlc run...

CVE-2026-83805 Nautobot: Authorization bypass in approval workflow REST API allows self-approval and unauthorized activation of scheduled jobs

Nautobot is a Network Source of Truth and Network Automation Platform. From 3.0.0 until 3.1.8, the generic ApprovalWorkflowStageResponse create endpoint does not enforce approver-group membership, change permission on the object under review, or the one-response-per-user restriction applied by th...

CVE-2026-83805 Nautobot: Authorization bypass in approval workflow REST API allows self-approval and unauthorized activation of scheduled jobs

Nautobot is a Network Source of Truth and Network Automation Platform. From 3.0.0 until 3.1.8, the generic ApprovalWorkflowStageResponse create endpoint does not enforce approver-group membership, change permission on the object under review, or the one-response-per-user restriction applied by th...

CVE-2026-83805

Nautobot versions 3.0.0 through 3.1.8 are vulnerable to an authorization bypass in the approval workflow REST API. The generic ApprovalWorkflowStageResponse create endpoint fails to enforce approver-group membership, object change permissions, or the one-response-per-user restriction. An attacker...

CVE-2026-75791

Zohocorp ManageEngine ADSelfService Plus versions before build 7001 are vulnerable to an authentication bypass vulnerability in the REST API...

CVE-2026-75791 Authentication bypass vulnerability

Zohocorp ManageEngine ADSelfService Plus versions before build 7001 are vulnerable to an authentication bypass vulnerability in the REST API...

CVE-2026-75791 Authentication bypass vulnerability

Zohocorp ManageEngine ADSelfService Plus versions before build 7001 are vulnerable to an authentication bypass vulnerability in the REST API...

CVE-2026-75791

ManageEngine ADSelfService Plus (by Zohocorp) versions before build 7001 are affected by an authentication bypass in its REST API . The vulnerability allows unauthenticated remote attackers to bypass authentication, with a CVSS 3.1 score of 8.6 (HIGH) — low attack complexity, no privileges or use...

EUVD-2026-84364

Zohocorp ManageEngine ADSelfService Plus versions before build 7001 are vulnerable to an authentication bypass vulnerability in the REST API...

CVE-2026-92882

Insufficiently protected credentials in the host and folder configuration endpoints of the REST API in Checkmk 2.5.0p15, 2.4.0p38, 2.3.0p51 and 2.2.0 EOL allows an authenticated user who may view a host's configuration to read stored SNMP community strings, SNMPv3 auth and privacy pass phrases an...

CVE-2026-92882 Redact SNMP community, SNMPv3 pass phrases, and IPMI password in host config REST API GET responses

Insufficiently protected credentials in the host and folder configuration endpoints of the REST API in Checkmk 2.5.0p15, 2.4.0p38, 2.3.0p51 and 2.2.0 EOL allows an authenticated user who may view a host's configuration to read stored SNMP community strings, SNMPv3 auth and privacy pass phrases an...

EUVD-2026-84349

Insufficiently protected credentials in the host and folder configuration endpoints of the REST API in Checkmk 2.5.0p15, 2.4.0p37, 2.3.0p51 and 2.2.0 EOL allows an authenticated user who may view a host's configuration to read stored SNMP community strings, SNMPv3 auth and privacy pass phrases an...